CVE-2025-52452
📋 TL;DR
This path traversal vulnerability in Salesforce Tableau Server allows attackers to access files outside the intended directory via the tabdoc API's duplicate-data-source modules. It affects Tableau Server installations on Windows and Linux before specific patched versions. Attackers could potentially read sensitive system files.
💻 Affected Systems
- Salesforce Tableau Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via reading sensitive configuration files, credentials, or deploying malicious payloads to arbitrary locations
Likely Case
Unauthorized reading of sensitive files containing credentials, configuration data, or other business information
If Mitigated
Limited impact if proper network segmentation and access controls prevent unauthorized API access
🎯 Exploit Status
Path traversal vulnerabilities typically have low exploitation complexity once the vulnerable endpoint is identified
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.1.3, 2024.2.12, or 2023.3.19 depending on your version track
Vendor Advisory: https://help.salesforce.com/s/articleView?id=005105043&type=1
Restart Required: Yes
Instructions:
1. Identify current Tableau Server version. 2. Download appropriate patch from Salesforce portal. 3. Apply patch following vendor instructions. 4. Restart Tableau Server services.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict access to Tableau Server API endpoints to trusted networks only
Web Application Firewall Rules
allImplement WAF rules to block path traversal patterns in API requests
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Tableau Server from sensitive systems
- Deploy web application firewall with path traversal detection rules
🔍 How to Verify
Check if Vulnerable:
Check Tableau Server version against affected versions listCheck Version:
On Tableau Server: Check administration settings or run appropriate version command for your OSVerify Fix Applied:
Verify version is 2025.1.3, 2024.2.12, or 2023.3.19 or later📡 Detection & Monitoring
Log Indicators:
- Unusual API requests to tabdoc endpoints with path traversal patterns (../ sequences)
- Failed file access attempts outside expected directories
Network Indicators:
- HTTP requests containing path traversal sequences to Tableau Server API endpoints
SIEM Query:
source="tableau" AND (uri="*../*" OR uri="*..\\*" OR method="POST" AND uri="*/api/*tabdoc*")